Malicious Office (OLE) / .DOC — malware analysis report

Static analysis result for SHA-256 090ed352c7b20665…

MALICIOUS

Office (OLE) / .DOC

132.0 KB
MD5: be20d2e8cac8443fc201cd25a512dd5a SHA-1: 9c6732787a1d7f366c7506dd6917cebf4c621711 SHA-256: 090ed352c7b206654608df6dcaa323243a8a0ab9a76d4197e829d87a90291025
160 Risk Score

Malware Insights

MITRE ATT&CK
T1203 Exploitation for Client Execution

The sample is a malicious OLE document containing embedded Excel and PowerPoint objects. Heuristics indicate the use of LoadLibrary and GetProcAddress APIs, commonly used for dynamic code loading and execution. The large slack space in the OLE structure is also suspicious. The document body contains Chinese text related to file construction and embedded objects, but does not provide a clear lure.

Heuristics 4

  • Office EPRINT stream contains EMF object high CVE related OLE_EPRINT_EMF_OBJECT
    OLE ObjectPool contains an EPRINT stream with EMF data. This is rare in normal documents and is CVE-2007-3893/MS07-046-family evidence when paired with Office exploit payload anomalies, but the malformed EMF record is not proven by this rule alone.
  • Reference to LoadLibrary API high SC_STR_LOADLIBRARY
    Reference to LoadLibrary API
  • Reference to GetProcAddress API high SC_STR_GETPROCADDRESS
    Reference to GetProcAddress API
  • OLE document has large unaccounted-for region high OLE_SLACK_ANOMALY
    OLE file is 135,168 bytes but its declared streams total only 31,351 bytes — 103,817 bytes (77%) live in unallocated sector slack. This is the canonical hiding place for pre-macro-era Office exploit payloads (XOR-encoded shellcode reached via a parser pointer-corruption bug in the document structure).